root/ubuntu-post-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply the local/remote Caddy mode resolution to every service, not just traccar

Browse Source 
traccar.sh's caddy_net wiring was fixed to mirror configure_caddy_for_service's
own mode resolution (CADDY_MODE from site config, then a local ~/docker/caddy,
then the legacy CADDY_REMOTE_HOST var) instead of only checking for the local
directory. That same bare directory check was copy-pasted into the caddy_net
wiring of every other Docker service in the repo, so a site with Caddy on a
different box would silently fail to join any of their containers to caddy_net
during setup (or, for homeassistant/koha, only get half the wiring right).

Applied the same fix mechanically across all 37 services using the standard
_CADDY_NET_BLOCK/_CADDY_NET_SECTION pattern (verified identical text via
scripted diff before touching any of them), plus by hand for:
- homeassistant.sh and koha.sh, which use their own differently-shaped
  variables (HA_CADDY_NET_LINES / _CADDY_NET_ENTRY) for the same decision
- paintplus.sh and ai-stack.sh, which do a live `docker network connect`
  instead of a compose network block
- watchyourlan.sh, whose Caddy note was worded for local-only setups

sms-inbound.sh got more than a mode swap: its Caddy wiring was hand-rolled
(not routed through configure_caddy_for_service) and had no remote-Caddy
path at all — a remote Caddy box would get a misleading "Caddy isn't
installed here" message instead of a snippet. Added
_sms_write_caddy_snippet(), mirroring the snippet-file pattern
configure_caddy_for_service uses everywhere else, and pointed the firewall
gate at the same three-way mode instead of a two-way dir check.

Verified: bash -n across all of services/*.sh, a scripted check that every
touched file has exactly one _CADDY_MODE resolution and no leftover bare
`[ -d "$DOCKER_DIR/caddy" ]` feeding a caddy_net decision, and spot-checked
docker compose config renders (traccar, mattermost) confirming the ${VAR}
interpolation and multi-service usage sites still resolve correctly.
This commit is contained in:
Claude
2026-08-03 18:54:02 +00:00
parent 6554256e8e
commit 1fc0a6edfe
43 changed files with 520 additions and 197 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/sms-inbound.sh
+60 -2
View File
@@ -581,6 +581,52 @@ CBLOCK
fi
}
# Remote-Caddy counterpart to _sms_configure_caddy — same site block, but a
# remote Caddy box can't resolve host.docker.internal (that hostname only
# works via the extra_hosts entry a LOCAL Caddy container gets) and isn't on
# this host's Docker bridge at all, so it has to reach the relay over this
# host's own IP and published port instead. Mirrors the snippet-file pattern
# configure_caddy_for_service uses for every other service (lib/common.sh).
_sms_write_caddy_snippet() {
local _domain="$1" _port="$2"
local _this_ip="${CADDY_REMOTE_HOST:-}"
[ -z "$_this_ip" ] && _this_ip="$(hostname -I 2>/dev/null | awk '{print $1}')"
[ -z "$_this_ip" ] && _this_ip="$(hostname -f 2>/dev/null || echo "127.0.0.1")"
local _snippet_dir="$DOCKER_DIR/caddy-snippets"
local _snippet_file="$_snippet_dir/sms-inbound.caddy"
mkdir -p "$_snippet_dir"
cat > "$_snippet_file" << CBLOCK
# Inbound SMS webhook (sms-inbound) — deliberately NOT behind Authelia:
# the SMS provider calls this unauthenticated. The secret is the token in
# the request path, checked by the relay itself.
${_domain} {
reverse_proxy ${_this_ip}:${_port}
header {
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
X-Content-Type-Options "nosniff"
Referrer-Policy "no-referrer"
}
log {
output file /var/log/caddy/${_domain}.log
format json
}
}
CBLOCK
chown "$ACTUAL_USER:$ACTUAL_USER" "$_snippet_file" 2>/dev/null || true
log_success "Snippet saved: $_snippet_file"
log_info "Copy to your Caddy machine and append to its Caddyfile:"
log_info " scp $_snippet_file caddy-host:~/caddy-snippets/"
log_info " cat ~/caddy-snippets/sms-inbound.caddy >> /path/to/Caddyfile"
log_info " docker restart caddy # reload API is disabled by default"
}
_sms_write_readme() {
local _url="$1" _relay_domain="$2"
write_readme "$SMS_APP_DIR" << MD
@@ -817,24 +863,36 @@ install_sms-inbound() {
[[ -n "${SITE_DOMAIN:-}" && "$SITE_DOMAIN" != "example.com" ]] && _default_domain="sms.${SITE_DOMAIN}"
prompt_text "Public domain for the webhook (A record must point here) [${_default_domain:-required}]:" "$_default_domain" RELAY_DOMAIN
# Mirrors configure_caddy_for_service's own mode resolution (lib/common.sh):
# explicit CADDY_MODE from the site config wins, then a local ~/docker/caddy,
# then the legacy CADDY_REMOTE_HOST var.
local _CADDY_MODE="${CADDY_MODE:-none}"
[ "$_CADDY_MODE" = "none" ] && [ -d "$DOCKER_DIR/caddy" ] && _CADDY_MODE="local"
[ "$_CADDY_MODE" = "none" ] && [ -n "${CADDY_REMOTE_HOST:-}" ] && _CADDY_MODE="remote"
if [[ -z "$RELAY_DOMAIN" ]]; then
log_warning "No domain entered — the relay is running but nothing can reach it yet."
log_warning "Re-run this service once DNS is ready, or front it with Caddy by hand."
elif [[ -d "$DOCKER_DIR/caddy" ]]; then
elif [ "$_CADDY_MODE" = "local" ]; then
_sms_configure_caddy "$RELAY_DOMAIN" "$RELAY_PORT"
elif [ "$_CADDY_MODE" = "remote" ]; then
_sms_write_caddy_snippet "$RELAY_DOMAIN" "$RELAY_PORT"
else
log_warning "Caddy isn't installed here — proxy https://${RELAY_DOMAIN} to"
log_warning "127.0.0.1:${RELAY_PORT} yourself, with a real certificate."
fi
if command -v ufw &>/dev/null; then
if [[ -d "$DOCKER_DIR/caddy" ]]; then
if [ "$_CADDY_MODE" = "local" ]; then
# Caddy reaches this over the caddy_net bridge, so the port has
# no business being open to the internet — but a bare `ufw
# delete allow` would block Caddy too (see CLAUDE.md).
ufw delete allow "${RELAY_PORT}/tcp" 2>/dev/null || true
ufw_allow_from_caddy_net "${RELAY_PORT}"
else
# No local Caddy to hide behind — a remote Caddy box needs to
# reach this port over the network, and with no Caddy at all the
# provider needs to reach it directly. Either way it stays open.
ufw allow "${RELAY_PORT}/tcp"
fi
ensure_ufw_enabled